Python Pwntools Hacking: ret2libc GOT & PLT

j-h.io/snyk || Snyk loves CTF challenges just like this for binary exploitation and web security -- you can use Snyk to find vulnerabilities in your own applications FOR FREE ➡ j-h.io/snyk
The challenge repository: github.com/JohnHammond/misfor...
The Binary Exploitation Breakdown video with Matt: • Binary Exploitation De...
🔥 KZbin ALGORITHM ➡ Like, Comment, & Subscribe!
🙏 SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎 FOLLOW ME EVERYWHERE ➡ jh.live/discord ↔ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware

[@randombar]

You are on a roll with uploads. I love your content.

[@ReligionAndMaterialismDebunked]

Yeee.

[@Smoth48]

Having just watched the longer video with you and Matt as a primer to this, this video is excellent and a wonderful distillation of the key information in that video. Very very cool, and very informative! Well done and thank you :)

[@melonscratcher]

A pleasure to watch your content Bro, keep doing your thing man 🎉

[@GenesisSnipingClan]

Dang bro you've got 500k subs now? I remember when you only had 10k

[@ReligionAndMaterialismDebunked]

First 🥇🏆 to reply here. Hehe. Yeah, he's one of the biggest ethical hackers on KZbin now. Hehe

[@JacobWK]

With you on that. John's one of the first people who got me really into this stuff. Now I'm over here in the field living it

[@ImJykai]

@@JacobWK yeah man i tried but ultimately, hacking aint for me. Id rather sell you a life insurance policy then go home and crack a beer lol

[@JacobWK]

@ImJykai can't die with life insurance 🤷‍♂️ valid point get me in on that insider life extender policy which gets me the added guaranteed 25 years of healthy living please

[@SpadesWoW]

Time flies man - feel you

[@msh6610]

Some leet haxing there 👍😍Thankfully stack-overflow attacks are hard to pull off 😨

[@hackwithprogramming7849]

Was waiting for this content thanks John lots of love from Goa 🔥❤️❤️❤️❤️❤️❤️

[@ava_l4nch264]

hello John tysm for this amazing video, I am a ctf player how is still trying to decide which category to focus on, and this video inspired me to look more at PWN. again tysm

[@bigdaddy5303]

The hair is a flowing sea of beauty

[@rahuldg9218]

Nice one john ❤️❤️❤️

[@KCM25NJL]

I like the technique a lot.... props to the folks who made pwntools, it's something else. Now, please pretty please.... can you run one of these using a modern binary that is not thrown together with obvious buffer overflows that one might have to work a little harder to get anywhere with? I totally appreciate this is sorta beginner level binary exploitation, but I do wonder if there is an intermediate -> expert level set of techniques that every day red teamers use on the bleeding edge of ethical hacking

[@_SanjayBiswas]

You are super talented. 🙏

[@Linux333]

Nice DEFCON t-shirt!

[@dantech_guru]

Best channel ever

[@hihihihihihihihihihi323]

finally, thanks dude. i feel seen.

[@zeshanahmednabin]

The exploit worked locally for me. But when I did the remote. It doesn't work. Dk why maybe some stack alignment issue. My local Ubuntu is 23.04.

[@hamstek6334]

Well done.

[@polychrus]

Hey John, I'm a biologist from Brazil who likes very much programming in general and security. I learn a lot with you! I was uncertain if it'd be good to say what I'm gonna say, but though you might find it interesting (you are totally free to delete the comment if you want, I'm not gonna bother with that!) and might find it cool to learn something new (as I always find, learning with your videos hehehe) and with no practical utility for you (totally nerdy thing to know). So: In the thumb, the snake you put there is not a python, actually it is another type of snake, a viper. I can tell it by some characteristics, such as its fangs. Viper have these big rear fangs, used to inject venom. Python snakes have no big hear fangs and also no venom. The prey is killed by constriction instead of venom. Again: just saying, I'm not by any means criticizing your work or meaning you "should've known this".

[@ReligionAndMaterialismDebunked]

🔥🔥🔥

[@user-nf7wp5wt4q]

8:05 memo~

[@WyldeZk]

This video is gold

[@CrazedMachine]

Damn that is cool to watch.

[@arjunraghunadhan3611]

Sir I am your big fan and i feel motivated after seeing your video I have a issue can you tell me roadmap to become in hacking level

[@JontheRippa]

❤👍 thank you

[@maxmusterspace6037]

I tried to compile the binary locally without using the docker stuff. But then I don't have the pop instructions in my binary. Why is that?

[@guilherme5094]

Really nice👍!

[@nadirstivan6088]

Hello, what is the first video in which you explain how to learn reverse engineering. I mean how to learn reverse engineering from scratch

[@RJZN5Gaming]

Can you help me learn Python like in this video? Please give me some keywords. What is so different about CTF coding and common coding?

[@fairyroot1653]

The most beautiful 44 minutes of my life

[@whathedogdoin]

cool

[@zoes17]

Snyk needs support for Rust... Er maybe they wait until the trademark RFC is decided since that might affect them if they were to try and develop something for it.

[@bhagyalakshmi1053]

Character watch scatter baheru letters was alf 'a,z' character

[@ruthvikas]

Day 3 of requesting to make videos on picoCTF 2023. Please.

[@_JohnHammond]

It's been on my list, I'll see how many I can put together!

[@ruthvikas]

@@_JohnHammond oh thank you 😁

[@equious8413]

I've been coding for years, have completed projects in 4 languages, run a web3 coding discord with hundreds of members, and still this is all absolutely nonsense to me lol Shit's wild.

[@forheuristiclifeksh7836]

3:56

[@M4rc311o]

I could be wrong but I think that there were no stack alignment issues at the start. The reason that you need to add one ret instruction was, that you were overwriting RBP which is base pointer, but return address is just after base pointer on stack so you need to add 8 more bytes to control RIP. But great video❤

[@forheuristiclifeksh7836]

0:59

[@LostInTheRush]

Hey John. I really like your content, so don't take this the wrong way. I've been wondering why I regularly have trouble focusing throughout your videos, and I think I've come to the conclusion that it's because you speak very "loudly" (not in amplitude obviously, but in articulation), which when listening for longer periods of time, can become quite mentally tiring. A bit like being yelled at for 44 minutes. Not sure if it's just my neurodivergent ass, but I thought I'd mention it. I mean, I assume you compress the audio as well to increase loudness, and if people need it louder, they can just increase the volume. I am 100% sure people will still find your videos interesting and engaging with a little less power on the speak. Keep up the great work though!

[@bhagyalakshmi1053]

Rsp what

[@bhagyalakshmi1053]

Cmp

[@mrirfan__07]

22:5

[@mrirfan__07]

5:11

[@akuuzii4077]

first

[@nadirstivan6088]

I'm talking about apps

[@craxxysum1264]

The snake on the thumbnail is not a python, bro, its not even a boa...see the fangs that's a viper...

[@vadim0ne930]

You're my hero

[@bhagyalakshmi1053]

R11,all numbers 🔢 list explain

[@forheuristiclifeksh7836]

4:12